All rights reserved.ĥ Contents Persistence Mechanisms 37 Agent Events 38 Users 39 Tasks and Their Attributes 39 Network Ports 39 Event Logs 40 Driver Modules 40 Device Tree 40 Hooks 40 DNS Entries 41 ARP Entries 41 Route Entries 41 System Restore 42 Prefetch 42 Disks 42 Volumes 43 Registry Hives 43 Browser URL History 43 Cookie History 44 Form History 44 File Download History 45 Investigation 47 Malware Risk Index (MRI) Scoring for Processes 47 View Redlined Processes and MRI Scores 48 Adjust MRI Scores 49 FireEye, Inc.
iĤ Contents Run Redline on This Computer 18 Running A Redline Collector 20 Step 1: Create a Collector on your Computer 20 Step 2: Run a Collector on a Host Computer 21 Step 3: Import Collector Data on your Computer 22 Analysis Session Creation 23 Import Data into Redline 23 Analyze Memory 24 Open HX Triage Collection 27 Open Saved Analysis Session 27 Analysis Data 28 Session Information 29 Data Not Collected 30 System Information 30 Network Adapters 30 Processes and Their Attributes 30 Handles 31 Memory Sections 31 Strings 32 Ports 32 Parent Process Tab 33 Files and Their Attributes 34 File Details 35 Viewing File Information 36 Registry 37 Windows Services 37 ii FireEye, Inc.
Redline Series User Guide Release 1.14 Revision 1 FireEye Contact Information: Website: Support Support Website: Phone: United States: FIREEYE ( ) United Kingdom: Other:ģ Contents Contents i About Redline 1 Timeline 1 Malware Risk Index (MRI) Score 1 Indicators of Compromise (IOCs) 2 Whitelists 2 Installation 3 System Requirements 3 Install 3 Upgrade 6 Uninstall 6 Redline Collectors 7 Select Redline Collector Type 7 Configure Standard and Comprehensive Redline Collectors 8 Configure IOC Search Redline Collector 9 Edit Redline Script 10 Memory Options in Script 11 Disk Options in Script 13 System Options in Script 14 Network Options in Script 15 Other Options in Script 16 Global Default Script Options 16 Run Redline Collector on Host Computer 18 FireEye, Inc. FireEye reserves the right to change, modify, transfer, or otherwise revise this publication without notice. FireEye assumes no responsibility for any inaccuracies in this document. All other trademarks are the property of their respective owners. in the United States and other countries.
2 FireEye and the FireEye logo are registered trademarks of FireEye, Inc.
0 kommentar(er)
